Gfyuki

So I need a way to send some webhooks to discord from a Windows machine, doing so in Linux is a no problems with curl, so I installed Ubuntu 18 LTS onto the machine from the Windows Apps store and gave it a go.

Here is where the problems start, when I use the same command in Windows:

bash -c "curl -H "Content-Type:application/json" -X POST -d '{"x": "x", "content": "hello"}' https://discordapp.com/api/webhooks/536660752111763477/zkW73A97-TNJVcH3xMCK0GMHEkwqKNWSfslA0WxxxxxxMYOLTRi6UMXYR_QLDCfxIJ_d"

I get this error:

{"code": 50006, "message": "Cannot send an empty message"}

What is it in that string that Windows doesn't like?

I messed with spaces and other stuff but only broke more.

The problem in your script is actually shown very clearly by the Ask Ubuntu syntax highlighting - as you can see in your answer, the "x" in your post is colored black, because it is outside of the double-quoted string that is the value for the -c parameter to bash. This problem is repeated throughout your code.

The way strings work in shell is that the double-quotes are a way to get multiple words (i.e. character sequences containing spaces) to appear as a single word for the shell. The shell then passes these words as is - without the enclosing string double-quotes - to the program for running. You can also cause text to be bunched into the same word by just squizzing the text together without spaces.

So the following commands are all the same for the shell, and will show the same output:

• echo 123


• echo "1"23


• echo "1"2"3"


• echo "1"'2'"3"

In all cases echo just sees the text "123" (the last one I put in some single quotes, which for a lot of effects behaves the same.

So with that in mind, let's analyze your script line:

bash -c "curl -H "Content-Type:application/json" -X POST -d '{"x": "x", "content": "hello"}' https://discordapp.com/some/path"

We can see that you are passing a lot of code to bash as the -c parameter, which is "the command to run". So bash will be run with two arguments - the first one is -c and the second one is all the text that should be considered "the command". The second argument uses double-quoted strings (yes, plural) to encode some spaces and other shell characters so they will be passed as is to the "command to run" parameter.

Let us do manually what the shell does to understand the second parameter, by converting all "words" as a classic programming language string array:

var a = [

"-c",

"curl -H " + "Content-Type:application/json" + " -X POST -d '{" + "x" + 

  ": " + "x" + ", " + "content" + ": " + "hello" + 

  "}' https://discordapp.com/some/path"

]

Then the shell will resolve the list of strings and will execute bash:

execve("bash", "-c", "curl -H Content-Type:application/json -X POST -d '{x: x, content: hello}' https://discordapp.com/some/path");

As you can see there are no more double quotes inside the JSON POST payload: they were removed by the shell trying to understand what strings make up the second argument. This causes the payload to become invalid and the server to think you didn't provide an input.

BTW: from my experience - what you've just demonstrated is the number 1 misunderstanding of how shell escaping work, so don't feel bad about it - everybody's doing it ;-)

What you want to do, if you want to put double quotes inside a double-quoted string is to "escape" them - make the shell not see them as special characters but as just part of the text of the string. There are two major ways to do this:

1. take advantage of the fact that strings in shell do not actually require quoting and could just be words bunched together without spaces, or multiple quoted string bunched together without spaces. So it could look like this: "curl -H "'"'"Content-Type:application/json"'"'" ...". You can see that instead of just putting a double-quote, we understand that double-quote actually terminates the string started at the beginning and isn't actually part of the input, and before the shell sees the end of the input (due to a space) we immediately start a new string, this one delimited by single quotes - that contain only a double-quote character, and so on - this is actually similar to the last echo command in the first example.


2. use backslash to cause the internal double-quote characters to not be considered string delimiters - escape them from parsing: "curl -H "Content-Type:application/json" -X...
   

I personally prefer the first method.